Detect Excessive Account Lockouts From Endpoint


This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.


Detect Excessive Account Lockouts From Endpoint Help

You must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. \ Splunk>Phantom Playbook Integration\ If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ (Playbook Link:\


Open in Search